A fine-grained permission control mechanism for external storage of Android

Android lacks fine-grained permission control for the external storage. Under the current coarse-grained mechanism, any application is able to access all the data on the external storage very easily. At the same time, many applications store sensitive data into the external storage, and some of these data are highly concerned with user privacy, which could bring severe security problems. In this paper, we propose a fine-grained permission control mechanism for external storage of Android. The mechanism is based on Filesystem in Userspace (FUSE) and offers the following features: protecting user private media files such as photos and videos; isolating the data of each application; providing access control settings for user. We implement this mechanism on the latest Android version, by introducing a new type of GID (ESDS-GID), extending the functionality of the emulated filesystem as well as the system services. The results of functional verification and performance benchmark show that with a reasonable performance overhead, this mechanism brings considerable enhancement for Android system security.